<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello,</p>
<p><br>
</p>
<p>today I implemented DNSSEC for a domain - by that I mean that the
DS records have been published / added to TLD DNS today, while the
zone has been signed a couple of days ago.<br>
</p>
<p><br>
</p>
<p>So a couple of hours later I went to <a moz-do-not-send="true"
href="https://dnsviz.net" class="moz-txt-link-freetext">https://dnsviz.net</a>
to see if everything seems OK and it reports one error and a
couple of warnings. The error is:</p>
<p><br>
</p>
<pre>RRSIG sid.si/NSEC3PARAM alg 13, id 48018: The TTL of the RRset (3600) exceeds the value of the Original TTL field of the RRSIG RR covering it (0).
</pre>
<p><br>
</p>
<p>But if I use <i>dig</i> for, I get this:</p>
<pre>;; ANSWER SECTION:
sid.si. 3600 IN NSEC3PARAM 1 0 10 -
sid.si. 3600 IN RRSIG NSEC3PARAM 13 2 0 20220205091303 20220106091303 48018 sid.si. WVstsjBLSQNS+PaKbR3LAAALG7tlV+cuzLYUKgWDXKrFnxe+dxx5Tmsa pYIrabwi/sANBgEBMHtW1Z3NS7hRow==
</pre>
<p><br>
</p>
<p>Both records show TTL 3600 - which should be OK, I think? Where
does dnsviz.net get that TTL 0?<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p>The warnings are:</p>
<pre>sid.si/DS (alg 13, id 12603): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).</pre>
<pre>sid.si/DS (alg 13, id 12603): DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1).</pre>
<pre>sid.si/DS (alg 13, id 12603): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset.</pre>
<pre>sid.si/DS (alg 13, id 12603): DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset.</pre>
<p><br>
</p>
<p>This is probably due to the fact that Bind version included in
CentOS 8 <i>dnssec-signzone</i> creates two 'digests' in the <i>dsset</i>
file (sha-1 and sha-256 - which is what I've sent to the domain
registrar to include), while newer Bind versions only create
one...<br>
</p>
<p><br>
</p>
<p>Is including SHA-1 bad in some way? Should I change that?<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p> Thanks,</p>
<p> Danilo</p>
</body>
</html>